Endpoint Security Introduction

In This Section:

Endpoint Security is a Management Software Blade in a Check Point Security Management Server. SmartEndpoint is the management console for Endpoint Security clients and their features.

Endpoint Security Features:

One management console for endpoint security management
Monitor your security status with a customizable, at-a-glance dashboard
Quickly deploy the required protection for users using software-blade deployment rules
Use pre-configured and customizable policies
Easily change and report security policy changes at all levels of the organization
Narrow-down to users and all their associated machines to investigate security status
Enforce and resolve endpoint compliance issues before permitting access to the corporate network

Overview of the System Architecture

An Endpoint Security environment includes SmartEndpoint, Endpoint Security Management Server, and Endpoint Security clients. It is integrated with the Check Point Security Management and SmartConsole.

Endpoint Security Management Server

Item	Description
SmartEndpoint	Check Point SmartConsole application to deploy, monitor and configure Endpoint Security clients and policies. Install on the Endpoint Security Management Server or on a computer that supports the client installation.
Endpoint Security Management Server	Software Blade on Security Management Server with Endpoint Security policy management and databases. It communicates with endpoint clients to update their policies and protection data.
Endpoint Security Blades	Software blades available on the Endpoint Security Management Server. You can install any or all of these blades on endpoint clients. See Software Blades.
Endpoint Security Database	Holds policies that enforce security on endpoint clients, holds user and computer objects, licensing, and Endpoint monitoring data.
Directory Scanner	Software component that synchronizes the structure and contents of the Active Directory with the Endpoint Security policy database.

Endpoint Security Clients

Item		Description

Endpoint Security Clients		Application installed on end-user computers to monitor security status and enforce security policies.
Endpoint Agent		Endpoint Security software on client computers. It operates as a container for Software Blades deployed on the endpoint client and communicates with the Endpoint Security Management Server. (Endpoint Agent is also known as the Device Agent or DA)
Endpoint Security Blades		Software blades deployed on the endpoint client.
	Note - When the term Endpoint Security Management Server is used, it refers to all Endpoint Security Servers in the environment. This includes Endpoint Security Management Servers or Endpoint Policy Servers.

Optional System Components

To make sure that your Endpoint Security system runs efficiently and without unnecessary down time, you can also include these components in your system architecture:

Additional Endpoint Policy Servers that manage traffic from the Endpoint Security clients. This improves performance in large environments.
One additional Endpoint Security Management Server for High Availability. This makes sure that a backup server is available if the primary server is down.

Endpoint Security Services and Ports

Endpoint Security operations are implemented by different services on the Endpoint Security Management Server, SmartEndpoint, and Endpoint Security clients.

Important - Make sure that these services and ports are not blocked by Firewall rules. To do so, connect to SmartConsole and SmartEndpoint on the Endpoint Security Management Server.

In SmartConsole, explicit rules are in Security Policies tab > Access Control.

See implied rules in Security Policies tab > Access Control > Actions > Implied Rules

Services used by the client to communicate with the Endpoint Security Management Server:

Client to Server Service	Protocol	Port	Notes
Policy downloads Anti-Virus updates Client package Application Control	HTTP	TCP/80
Endpoint registration New file encryption key retrieval	HTTPS	TCP/443	Used to encrypt messages sent using the Endpoint Security Encrypted Protocol
Synchronization request Heartbeat Log upload	ESP Encrypted	TCP/80	Heartbeat, communicates policy, status and compliance changes.
Full Disk Encryption Recovery Data Upload Media Encryption & Port Protection Key Exchange Full Disk Encryption User Acquisition & User credentials.	ESP Encrypted	TCP/443

SmartEndpoint uses SIC to reach the Endpoint Security Management Server:

Service	Protocol	Port
Check Point Secure Internal Communication	SIC	TCP/18190 - 18193

Before installing Endpoint Security Management Server, make sure these ports are not blocked:

TCP Port	Reserved for:
8080	Communication between Security Management Server and Directory Scanner to Tomcat
8009	Communication between Apache and Tomcat
1080	SOCKS Proxy